From: Greg Kroah-Hartman Date: Tue, 4 Oct 2016 16:22:35 +0000 (+0200) Subject: 4.7-stable patches X-Git-Tag: v4.8.1~27 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=76815a7d795534a10ecb2eb2ce531d9f275906d4;p=thirdparty%2Fkernel%2Fstable-queue.git 4.7-stable patches added patches: iwlwifi-mvm-avoid-harmless-wmaybe-uninialized-warning.patch iwlwifi-mvm-checksum-ipv6-fragmented-packet.patch iwlwifi-mvm-don-t-use-ret-when-not-initialised.patch iwlwifi-mvm-fix-txq-aggregation-bug.patch iwlwifi-mvm-free-rx-reorder-buffer-on-restart.patch iwlwifi-mvm-handle-frame_release-in-mq-code.patch iwlwifi-mvm-unmap-the-paging-memory-before-freeing-it.patch iwlwifi-mvm-write-the-correct-internal-txf-index.patch iwlwifi-pcie-fix-access-to-scratch-buffer.patch --- diff --git a/queue-4.7/iwlwifi-mvm-avoid-harmless-wmaybe-uninialized-warning.patch b/queue-4.7/iwlwifi-mvm-avoid-harmless-wmaybe-uninialized-warning.patch new file mode 100644 index 00000000000..c694f00842a --- /dev/null +++ b/queue-4.7/iwlwifi-mvm-avoid-harmless-wmaybe-uninialized-warning.patch @@ -0,0 +1,107 @@ +From 5a7d87da8d9b9f04ecdbebe7e5710a1391f85fa8 Mon Sep 17 00:00:00 2001 +From: Arnd Bergmann +Date: Fri, 27 May 2016 15:07:03 +0200 +Subject: iwlwifi: mvm: avoid harmless -Wmaybe-uninialized warning +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Arnd Bergmann + +commit 5a7d87da8d9b9f04ecdbebe7e5710a1391f85fa8 upstream. + +gcc is apparently unablel to track the state of the local 'resp_v2' +variable across the kzalloc() function, and warns about the response +variable being used without an initialization: + +drivers/net/wireless/intel/iwlwifi/mvm/nvm.c: In function ‘iwl_mvm_update_mcc’: +drivers/net/wireless/intel/iwlwifi/mvm/nvm.c:727:36: warning: ‘mcc_resp_v1’ may be used uninitialized in this function [-Wmaybe-uninitialized] + resp_cp->n_channels = mcc_resp_v1->n_channels; +drivers/net/wireless/intel/iwlwifi/mvm/nvm.c:721:3: warning: ‘mcc_resp’ may be used uninitialized in this function [-Wmaybe-uninitialized] + memcpy(resp_cp, mcc_resp, resp_len); + +The warning showed up in x86 allmodconfig after my patch to +unhide -Wmaybe-uninitialized warnings by default was merged, +though it always existed in randconfig builds. I did not +catch the warning earlier because I was testing on ARM, which +never produced the warning. + +This rearranges the code in a way that improves readability for +both humans and the compiler, and that avoids the warning. + +Signed-off-by: Arnd Bergmann +Fixes: 6fa52430f0b3 ("iwlwifi: mvm: change mcc update API") +Signed-off-by: Luca Coelho +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/wireless/intel/iwlwifi/mvm/nvm.c | 41 +++++++++++++-------------- + 1 file changed, 21 insertions(+), 20 deletions(-) + +--- a/drivers/net/wireless/intel/iwlwifi/mvm/nvm.c ++++ b/drivers/net/wireless/intel/iwlwifi/mvm/nvm.c +@@ -667,8 +667,7 @@ iwl_mvm_update_mcc(struct iwl_mvm *mvm, + .mcc = cpu_to_le16(alpha2[0] << 8 | alpha2[1]), + .source_id = (u8)src_id, + }; +- struct iwl_mcc_update_resp *mcc_resp, *resp_cp = NULL; +- struct iwl_mcc_update_resp_v1 *mcc_resp_v1 = NULL; ++ struct iwl_mcc_update_resp *resp_cp; + struct iwl_rx_packet *pkt; + struct iwl_host_cmd cmd = { + .id = MCC_UPDATE_CMD, +@@ -701,34 +700,36 @@ iwl_mvm_update_mcc(struct iwl_mvm *mvm, + + /* Extract MCC response */ + if (resp_v2) { +- mcc_resp = (void *)pkt->data; ++ struct iwl_mcc_update_resp *mcc_resp = (void *)pkt->data; ++ + n_channels = __le32_to_cpu(mcc_resp->n_channels); ++ resp_len = sizeof(struct iwl_mcc_update_resp) + ++ n_channels * sizeof(__le32); ++ resp_cp = kmemdup(mcc_resp, resp_len, GFP_KERNEL); + } else { +- mcc_resp_v1 = (void *)pkt->data; ++ struct iwl_mcc_update_resp_v1 *mcc_resp_v1 = (void *)pkt->data; ++ + n_channels = __le32_to_cpu(mcc_resp_v1->n_channels); ++ resp_len = sizeof(struct iwl_mcc_update_resp) + ++ n_channels * sizeof(__le32); ++ resp_cp = kzalloc(resp_len, GFP_KERNEL); ++ ++ if (resp_cp) { ++ resp_cp->status = mcc_resp_v1->status; ++ resp_cp->mcc = mcc_resp_v1->mcc; ++ resp_cp->cap = mcc_resp_v1->cap; ++ resp_cp->source_id = mcc_resp_v1->source_id; ++ resp_cp->n_channels = mcc_resp_v1->n_channels; ++ memcpy(resp_cp->channels, mcc_resp_v1->channels, ++ n_channels * sizeof(__le32)); ++ } + } + +- resp_len = sizeof(struct iwl_mcc_update_resp) + n_channels * +- sizeof(__le32); +- +- resp_cp = kzalloc(resp_len, GFP_KERNEL); + if (!resp_cp) { + ret = -ENOMEM; + goto exit; + } + +- if (resp_v2) { +- memcpy(resp_cp, mcc_resp, resp_len); +- } else { +- resp_cp->status = mcc_resp_v1->status; +- resp_cp->mcc = mcc_resp_v1->mcc; +- resp_cp->cap = mcc_resp_v1->cap; +- resp_cp->source_id = mcc_resp_v1->source_id; +- resp_cp->n_channels = mcc_resp_v1->n_channels; +- memcpy(resp_cp->channels, mcc_resp_v1->channels, +- n_channels * sizeof(__le32)); +- } +- + status = le32_to_cpu(resp_cp->status); + + mcc = le16_to_cpu(resp_cp->mcc); diff --git a/queue-4.7/iwlwifi-mvm-checksum-ipv6-fragmented-packet.patch b/queue-4.7/iwlwifi-mvm-checksum-ipv6-fragmented-packet.patch new file mode 100644 index 00000000000..d655c190bb1 --- /dev/null +++ b/queue-4.7/iwlwifi-mvm-checksum-ipv6-fragmented-packet.patch @@ -0,0 +1,58 @@ +From ecf51424152bad1b2727409f42ddf1bd86f44b7d Mon Sep 17 00:00:00 2001 +From: Sara Sharon +Date: Wed, 8 Jun 2016 15:15:41 +0300 +Subject: iwlwifi: mvm: checksum IPv6 fragmented packet + +From: Sara Sharon + +commit ecf51424152bad1b2727409f42ddf1bd86f44b7d upstream. + +Our HW does not support checksum of fragmented packets. +Fix code accordingly to checksum those packets in the driver. + +Signed-off-by: Sara Sharon +Fixes: 5e6a98dc4863 ("iwlwifi: mvm: enable TCP/UDP checksum support for 9000 family") +Signed-off-by: Luca Coelho +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/wireless/intel/iwlwifi/mvm/tx.c | 21 ++++++--------------- + 1 file changed, 6 insertions(+), 15 deletions(-) + +--- a/drivers/net/wireless/intel/iwlwifi/mvm/tx.c ++++ b/drivers/net/wireless/intel/iwlwifi/mvm/tx.c +@@ -138,28 +138,19 @@ static void iwl_mvm_tx_csum(struct iwl_m + + protocol = ipv6h->nexthdr; + while (protocol != NEXTHDR_NONE && ipv6_ext_hdr(protocol)) { ++ struct ipv6_opt_hdr *hp; ++ + /* only supported extension headers */ + if (protocol != NEXTHDR_ROUTING && + protocol != NEXTHDR_HOP && +- protocol != NEXTHDR_DEST && +- protocol != NEXTHDR_FRAGMENT) { ++ protocol != NEXTHDR_DEST) { + skb_checksum_help(skb); + return; + } + +- if (protocol == NEXTHDR_FRAGMENT) { +- struct frag_hdr *hp = +- OPT_HDR(struct frag_hdr, skb, off); +- +- protocol = hp->nexthdr; +- off += sizeof(struct frag_hdr); +- } else { +- struct ipv6_opt_hdr *hp = +- OPT_HDR(struct ipv6_opt_hdr, skb, off); +- +- protocol = hp->nexthdr; +- off += ipv6_optlen(hp); +- } ++ hp = OPT_HDR(struct ipv6_opt_hdr, skb, off); ++ protocol = hp->nexthdr; ++ off += ipv6_optlen(hp); + } + /* if we get here - protocol now should be TCP/UDP */ + #endif diff --git a/queue-4.7/iwlwifi-mvm-don-t-use-ret-when-not-initialised.patch b/queue-4.7/iwlwifi-mvm-don-t-use-ret-when-not-initialised.patch new file mode 100644 index 00000000000..985f24e5a22 --- /dev/null +++ b/queue-4.7/iwlwifi-mvm-don-t-use-ret-when-not-initialised.patch @@ -0,0 +1,31 @@ +From ff6e58e648ed5f3cc43891767811d5c3c88bbd41 Mon Sep 17 00:00:00 2001 +From: Emmanuel Grumbach +Date: Wed, 3 Aug 2016 22:06:43 +0300 +Subject: iwlwifi: mvm: don't use ret when not initialised + +From: Emmanuel Grumbach + +commit ff6e58e648ed5f3cc43891767811d5c3c88bbd41 upstream. + +fw-dbg code return ret but that variable was either 0 +or not initialised. Return 0 always. + +Signed-off-by: Emmanuel Grumbach +Fixes: 6a95126763fb ("iwlwifi: mvm: send dbg config hcmds to fw if set in tlv") +Signed-off-by: Luca Coelho +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/wireless/intel/iwlwifi/mvm/fw-dbg.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/drivers/net/wireless/intel/iwlwifi/mvm/fw-dbg.c ++++ b/drivers/net/wireless/intel/iwlwifi/mvm/fw-dbg.c +@@ -960,5 +960,6 @@ int iwl_mvm_start_fw_dbg_conf(struct iwl + } + + mvm->fw_dbg_conf = conf_id; +- return ret; ++ ++ return 0; + } diff --git a/queue-4.7/iwlwifi-mvm-fix-txq-aggregation-bug.patch b/queue-4.7/iwlwifi-mvm-fix-txq-aggregation-bug.patch new file mode 100644 index 00000000000..9bdaf661c5b --- /dev/null +++ b/queue-4.7/iwlwifi-mvm-fix-txq-aggregation-bug.patch @@ -0,0 +1,55 @@ +From 2c4a247e42526d9aae8f5ce1f190b893532f2806 Mon Sep 17 00:00:00 2001 +From: Oren Givon +Date: Sun, 29 May 2016 14:05:50 +0300 +Subject: iwlwifi: mvm: fix txq aggregation bug + +From: Oren Givon + +commit 2c4a247e42526d9aae8f5ce1f190b893532f2806 upstream. + +Fix an issue where nullfunc frames and block ack requests +had the same tid as aggregation frames and were queued on +a non aggregation queue. The pending frames counter included +those frames but the check whether to decrement the pending +frames counter relied on the tid status and not on the txq id. +The result was an inconsistent state of the pending frames +counter followed by a failure to remove the station. +This failure triggered SYSASSERT 0x3421. + +In addition, fix a situation in DQA mode where the number +of pending frames turned negative. This was due to the TX queue +being on the IWL_EMPTYING_HW_QUEUE_DELBA state and its frames +were still decremented. + +Even though the SYSASSERT issue is fixed when DQA is disabled, +the issue is not completely solved when DQA is enabled and +should still be fixed. + +Signed-off-by: Oren Givon +Fixes: cf961e16620f ("iwlwifi: mvm: support dqa-mode agg on non-shared queue") +Signed-off-by: Luca Coelho +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/wireless/intel/iwlwifi/mvm/tx.c | 10 +++++++++- + 1 file changed, 9 insertions(+), 1 deletion(-) + +--- a/drivers/net/wireless/intel/iwlwifi/mvm/tx.c ++++ b/drivers/net/wireless/intel/iwlwifi/mvm/tx.c +@@ -1303,7 +1303,15 @@ static void iwl_mvm_rx_tx_cmd_single(str + bool send_eosp_ndp = false; + + spin_lock_bh(&mvmsta->lock); +- txq_agg = (mvmsta->tid_data[tid].state == IWL_AGG_ON); ++ if (iwl_mvm_is_dqa_supported(mvm)) { ++ enum iwl_mvm_agg_state state; ++ ++ state = mvmsta->tid_data[tid].state; ++ txq_agg = (state == IWL_AGG_ON || ++ state == IWL_EMPTYING_HW_QUEUE_DELBA); ++ } else { ++ txq_agg = txq_id >= mvm->first_agg_queue; ++ } + + if (!is_ndp) { + tid_data->next_reclaimed = next_reclaimed; diff --git a/queue-4.7/iwlwifi-mvm-free-rx-reorder-buffer-on-restart.patch b/queue-4.7/iwlwifi-mvm-free-rx-reorder-buffer-on-restart.patch new file mode 100644 index 00000000000..f1d0c9bc0aa --- /dev/null +++ b/queue-4.7/iwlwifi-mvm-free-rx-reorder-buffer-on-restart.patch @@ -0,0 +1,40 @@ +From 60dec5233cd8651860e8010c953d116fb0f1ba86 Mon Sep 17 00:00:00 2001 +From: Sara Sharon +Date: Tue, 21 Jun 2016 14:14:08 +0300 +Subject: iwlwifi: mvm: free RX reorder buffer on restart + +From: Sara Sharon + +commit 60dec5233cd8651860e8010c953d116fb0f1ba86 upstream. + +Restart flow zeroes the rx_ba_sessions counter. Mac80211 asks +driver to tear down of the session only afterwards, and as a +result driver didn't free the data. Fix it. + +Signed-off-by: Sara Sharon +Fixes: 10b2b2019d81 ("iwlwifi: mvm: add infrastructure for tracking BA session in driver") +Signed-off-by: Luca Coelho +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/wireless/intel/iwlwifi/mvm/sta.c | 7 ++++--- + 1 file changed, 4 insertions(+), 3 deletions(-) + +--- a/drivers/net/wireless/intel/iwlwifi/mvm/sta.c ++++ b/drivers/net/wireless/intel/iwlwifi/mvm/sta.c +@@ -1374,11 +1374,12 @@ int iwl_mvm_sta_rx_agg(struct iwl_mvm *m + */ + WARN_ON(rcu_access_pointer(mvm->baid_map[baid])); + rcu_assign_pointer(mvm->baid_map[baid], baid_data); +- } else if (mvm->rx_ba_sessions > 0) { ++ } else { + u8 baid = mvm_sta->tid_to_baid[tid]; + +- /* check that restart flow didn't zero the counter */ +- mvm->rx_ba_sessions--; ++ if (mvm->rx_ba_sessions > 0) ++ /* check that restart flow didn't zero the counter */ ++ mvm->rx_ba_sessions--; + if (!iwl_mvm_has_new_rx_api(mvm)) + return 0; + diff --git a/queue-4.7/iwlwifi-mvm-handle-frame_release-in-mq-code.patch b/queue-4.7/iwlwifi-mvm-handle-frame_release-in-mq-code.patch new file mode 100644 index 00000000000..ffe7a495bac --- /dev/null +++ b/queue-4.7/iwlwifi-mvm-handle-frame_release-in-mq-code.patch @@ -0,0 +1,43 @@ +From 58035432d60616cc2ef6514a3d0e6d6ad01bf705 Mon Sep 17 00:00:00 2001 +From: Johannes Berg +Date: Wed, 27 Apr 2016 13:33:26 +0200 +Subject: iwlwifi: mvm: handle FRAME_RELEASE in MQ code + +From: Johannes Berg + +commit 58035432d60616cc2ef6514a3d0e6d6ad01bf705 upstream. + +For some reason, the FRAME_RELEASE message handling for the +default queue ended up being in the only/default queue for +non-RSS devices; fix that and handle FRAME_RELEASE properly +on the default queue for RSS devices. + +Fixes: 585a6fccf5b8 ("iwlwifi: mvm: infrastructure for frame-release message") +Signed-off-by: Johannes Berg +Signed-off-by: Luca Coelho +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/wireless/intel/iwlwifi/mvm/ops.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/drivers/net/wireless/intel/iwlwifi/mvm/ops.c ++++ b/drivers/net/wireless/intel/iwlwifi/mvm/ops.c +@@ -936,8 +936,6 @@ static void iwl_mvm_rx(struct iwl_op_mod + + if (likely(pkt->hdr.cmd == REPLY_RX_MPDU_CMD)) + iwl_mvm_rx_rx_mpdu(mvm, napi, rxb); +- else if (pkt->hdr.cmd == FRAME_RELEASE) +- iwl_mvm_rx_frame_release(mvm, napi, rxb, 0); + else if (pkt->hdr.cmd == REPLY_RX_PHY_CMD) + iwl_mvm_rx_rx_phy_cmd(mvm, rxb); + else +@@ -958,6 +956,8 @@ static void iwl_mvm_rx_mq(struct iwl_op_ + else if (unlikely(pkt->hdr.group_id == DATA_PATH_GROUP && + pkt->hdr.cmd == RX_QUEUES_NOTIFICATION)) + iwl_mvm_rx_queue_notif(mvm, rxb, 0); ++ else if (pkt->hdr.cmd == FRAME_RELEASE) ++ iwl_mvm_rx_frame_release(mvm, napi, rxb, 0); + else + iwl_mvm_rx_common(mvm, rxb, pkt); + } diff --git a/queue-4.7/iwlwifi-mvm-unmap-the-paging-memory-before-freeing-it.patch b/queue-4.7/iwlwifi-mvm-unmap-the-paging-memory-before-freeing-it.patch new file mode 100644 index 00000000000..748e503bcd2 --- /dev/null +++ b/queue-4.7/iwlwifi-mvm-unmap-the-paging-memory-before-freeing-it.patch @@ -0,0 +1,48 @@ +From 3edbc7dabab8ce85aa75c5e290ecda7a3692ebc9 Mon Sep 17 00:00:00 2001 +From: Emmanuel Grumbach +Date: Sun, 19 Jun 2016 20:57:02 +0300 +Subject: iwlwifi: mvm: unmap the paging memory before freeing it + +From: Emmanuel Grumbach + +commit 3edbc7dabab8ce85aa75c5e290ecda7a3692ebc9 upstream. + +This led to a DMA splat. + +Fixes: a6c4fb4441f4 ("iwlwifi: mvm: Add FW paging mechanism for the UMAC on PCI") +Signed-off-by: Emmanuel Grumbach +Signed-off-by: Luca Coelho +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/wireless/intel/iwlwifi/mvm/fw.c | 12 ++++++++---- + 1 file changed, 8 insertions(+), 4 deletions(-) + +--- a/drivers/net/wireless/intel/iwlwifi/mvm/fw.c ++++ b/drivers/net/wireless/intel/iwlwifi/mvm/fw.c +@@ -139,17 +139,21 @@ void iwl_free_fw_paging(struct iwl_mvm * + return; + + for (i = 0; i < NUM_OF_FW_PAGING_BLOCKS; i++) { +- if (!mvm->fw_paging_db[i].fw_paging_block) { ++ struct iwl_fw_paging *paging = &mvm->fw_paging_db[i]; ++ ++ if (!paging->fw_paging_block) { + IWL_DEBUG_FW(mvm, + "Paging: block %d already freed, continue to next page\n", + i); + + continue; + } ++ dma_unmap_page(mvm->trans->dev, paging->fw_paging_phys, ++ paging->fw_paging_size, DMA_BIDIRECTIONAL); + +- __free_pages(mvm->fw_paging_db[i].fw_paging_block, +- get_order(mvm->fw_paging_db[i].fw_paging_size)); +- mvm->fw_paging_db[i].fw_paging_block = NULL; ++ __free_pages(paging->fw_paging_block, ++ get_order(paging->fw_paging_size)); ++ paging->fw_paging_block = NULL; + } + kfree(mvm->trans->paging_download_buf); + mvm->trans->paging_download_buf = NULL; diff --git a/queue-4.7/iwlwifi-mvm-write-the-correct-internal-txf-index.patch b/queue-4.7/iwlwifi-mvm-write-the-correct-internal-txf-index.patch new file mode 100644 index 00000000000..f97b631da31 --- /dev/null +++ b/queue-4.7/iwlwifi-mvm-write-the-correct-internal-txf-index.patch @@ -0,0 +1,39 @@ +From e7c9bd1cc632e924a69bf704385484386bb10933 Mon Sep 17 00:00:00 2001 +From: Golan Ben-Ami +Date: Wed, 15 Jun 2016 09:16:24 +0300 +Subject: iwlwifi: mvm: write the correct internal TXF index + +From: Golan Ben-Ami + +commit e7c9bd1cc632e924a69bf704385484386bb10933 upstream. + +The TX fifos are arranged consecutively in the SMEM, beginning +with the regular fifos, and tailed by the internal fifos. +In the current code, while trying to read the internal fifos, +we read the fifos beginning with the index zero. +By doing this we actually re-read the regular fifos. + +In order to read the internal fifos, start the reading index +from the number of regular fifos configured by the fw. + +Signed-off-by: Golan Ben-Ami +Fixes: 39654cb3a6a2 ("iwlwifi: don't access a nonexistent register upon assert") +Signed-off-by: Luca Coelho +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/wireless/intel/iwlwifi/mvm/fw-dbg.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/drivers/net/wireless/intel/iwlwifi/mvm/fw-dbg.c ++++ b/drivers/net/wireless/intel/iwlwifi/mvm/fw-dbg.c +@@ -288,7 +288,8 @@ static void iwl_mvm_dump_fifos(struct iw + fifo_hdr->fifo_num = cpu_to_le32(i); + + /* Mark the number of TXF we're pulling now */ +- iwl_trans_write_prph(mvm->trans, TXF_CPU2_NUM, i); ++ iwl_trans_write_prph(mvm->trans, TXF_CPU2_NUM, i + ++ ARRAY_SIZE(mvm->shared_mem_cfg.txfifo_size)); + + fifo_hdr->available_bytes = + cpu_to_le32(iwl_trans_read_prph(mvm->trans, diff --git a/queue-4.7/iwlwifi-pcie-fix-access-to-scratch-buffer.patch b/queue-4.7/iwlwifi-pcie-fix-access-to-scratch-buffer.patch new file mode 100644 index 00000000000..90feb8e8445 --- /dev/null +++ b/queue-4.7/iwlwifi-pcie-fix-access-to-scratch-buffer.patch @@ -0,0 +1,43 @@ +From d5d0689aefc59c6a5352ca25d7e6d47d03f543ce Mon Sep 17 00:00:00 2001 +From: Sara Sharon +Date: Thu, 9 Jun 2016 17:19:35 +0300 +Subject: iwlwifi: pcie: fix access to scratch buffer + +From: Sara Sharon + +commit d5d0689aefc59c6a5352ca25d7e6d47d03f543ce upstream. + +This fixes a pretty ancient bug that hasn't manifested itself +until now. +The scratchbuf for command queue is allocated only for 32 slots +but is accessed with the queue write pointer - which can be +up to 256. +Since the scratch buf size was 16 and there are up to 256 TFDs +we never passed a page boundary when accessing the scratch buffer, +but when attempting to increase the size of the scratch buffer a +panic was quick to follow when trying to access the address resulted +in a page boundary. + +Signed-off-by: Sara Sharon +Fixes: 38c0f334b359 ("iwlwifi: use coherent DMA memory for command header") +Signed-off-by: Luca Coelho +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/wireless/intel/iwlwifi/pcie/tx.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/drivers/net/wireless/intel/iwlwifi/pcie/tx.c ++++ b/drivers/net/wireless/intel/iwlwifi/pcie/tx.c +@@ -1595,9 +1595,9 @@ static int iwl_pcie_enqueue_hcmd(struct + + /* start the TFD with the scratchbuf */ + scratch_size = min_t(int, copy_size, IWL_HCMD_SCRATCHBUF_SIZE); +- memcpy(&txq->scratchbufs[q->write_ptr], &out_cmd->hdr, scratch_size); ++ memcpy(&txq->scratchbufs[idx], &out_cmd->hdr, scratch_size); + iwl_pcie_txq_build_tfd(trans, txq, +- iwl_pcie_get_scratchbuf_dma(txq, q->write_ptr), ++ iwl_pcie_get_scratchbuf_dma(txq, idx), + scratch_size, true); + + /* map first command fragment, if any remains */ diff --git a/queue-4.7/series b/queue-4.7/series index 13892482e95..6e11e66a7b7 100644 --- a/queue-4.7/series +++ b/queue-4.7/series @@ -24,3 +24,12 @@ nvmem-declare-nvmem_cell_read-consistently.patch hwmon-adt7411-set-bit-3-in-cfg1-register.patch sched-cputime-fix-prev-steal-time-accouting-during-cpu-hotplug.patch spi-sh-msiof-avoid-invalid-clock-generator-parameters.patch +iwlwifi-mvm-handle-frame_release-in-mq-code.patch +iwlwifi-mvm-checksum-ipv6-fragmented-packet.patch +iwlwifi-mvm-fix-txq-aggregation-bug.patch +iwlwifi-mvm-write-the-correct-internal-txf-index.patch +iwlwifi-mvm-unmap-the-paging-memory-before-freeing-it.patch +iwlwifi-pcie-fix-access-to-scratch-buffer.patch +iwlwifi-mvm-free-rx-reorder-buffer-on-restart.patch +iwlwifi-mvm-avoid-harmless-wmaybe-uninialized-warning.patch +iwlwifi-mvm-don-t-use-ret-when-not-initialised.patch